Linguistic semantic analysis monitoring/alert integration system

ABSTRACT

A linguistic semantic analysis monitoring/alert integration system includes at least one storage device storing one or more monitoring dictionary databases that include module-specific language information that identifies module-specific language terms utilized in providing a monitoring module. A linguistic semantic monitoring analysis engine is coupled to the at least one storage device. The linguistic semantic monitoring analysis engine receives a file included in a monitoring module, parses the file to identify file language terms included in the file, and matches the file language terms included in the file with the module-specific language terms included in the module-specific language information. Based on the matching of the file programming language terms with the module-specific programming language terms, intent for the file language terms is determined and used to automatically classify the file into a respective one of a plurality of monitoring model databases.

BACKGROUND

The present disclosure relates generally to information handlingsystems, and more particularly to the use of linguistic semanticanalysis to provide for the integration of monitoring and alerts withinformation handling systems

As the value and use of information continues to increase, individualsand businesses seek additional ways to process and store information.One option available to users is information handling systems. Aninformation handling system generally processes, compiles, stores,and/or communicates information or data for business, personal, or otherpurposes thereby allowing users to take advantage of the value of theinformation. Because technology and information handling needs andrequirements vary between different users or applications, informationhandling systems may also vary regarding what information is handled,how the information is handled, how much information is processed,stored, or communicated, and how quickly and efficiently the informationmay be processed, stored, or communicated. The variations in informationhandling systems allow for information handling systems to be general orconfigured for a specific user or specific use such as financialtransaction processing, airline reservations, enterprise data storage,or global communications. In addition, information handling systems mayinclude a variety of hardware and software components that may beconfigured to process, store, and communicate information and mayinclude one or more computer systems, data storage systems, andnetworking systems.

Information handling systems such as, for example, server devices,storage devices, networking devices, and/or other computing devices,utilize applications that interact with the hardware and software in thecomputing devices. However, the integration of applications for use withcomputing devices raises some issues. For example, a computing devicemanufacturer may integrate applications with their computing devicesthat monitor the hardware and software in those computing devices, whichtypically involves identifying the systems management artifactsdeveloped for the hardware (e.g., Management Information Bases (MlBs),profiles, schemas, Representational State Transfer (REST) interfaces,Application Programming Interfaces (APIs), etc.), and write code thatintegrates those system management artifacts with the applications.However, such activities are time intensive, as significant effort isinvolved in understanding and analyzing the meaning of elements utilizedby the system management artifacts. Furthermore, requests forapplication integration are frequent, and the time intensive processdiscussed above prevents may of those requests from being satisfied.Further still, even when such requests are filled, integratingapplications to operate with current computing device firmware isassociated with the same issues, and thus even integrated applicationswill quickly fail to operate with all available firmware functionality(i.e., as that firmware is updated). Providing support for new computingdevice products presents similar issues, as even when a computing deviceproduct is provided with a library (e.g., a Python or Powershelllibrary), application integration requires those libraries be studied tounderstand the meaning of their terms, along with the writing of “glue”logic to integrate them to operate with those applications.

For example, monitoring software such as, for example, Nagios softwareavailable at www.nagios.org, System Center Operations Manager (SCOM)available from MICROSOFT® of Redmond, Wash., United States, and Zabbixsoftware available at www.zabbix.com, provide for the monitoring ofinventory, performance metrics, configurations, health information,operational information, and/or a variety of other informationassociated with computing devices. Furthermore, the different monitoringsoftware monitors, collects, and presents this information in differentways. Conventionally, computing device manufacturers attempt to identifyvariables in the MIBs, Meta-Object Facilities (MOFs), and RESTfulschema, and then model those variables into different information modelssuch as health information models, metric information models,configuration information models, and inventory information models.Furthermore, changes in these artifacts (e.g., enumeration changes, newvariable additions, new alert definitions, new knowledge articles, etc.)must be identified, and updates must be properly represented in themonitoring software. Further still, this data must be reconciled acrossdifferent protocols, with the common variables utilized in the differentprotocols mapped to each other. These operations are complicated by thefact that component tree structures for the systems that execute theseapplications are often not readily available. In addition, alerts thatare based upon such monitoring and that notify users as to what ishappening in the computing device are often duplicative.

Accordingly, it would be desirable to provide improved integration ofmonitoring and alerts provided for computing devices.

SUMMARY

According to one embodiment, an Information Handling System (IHS)includes a processing system; and a memory system that is coupled to theprocessing system and that includes instructions that, when executed bythe processing system, cause the processing system to provide alinguistic semantic monitoring analysis engine that is configured to:receive a file included in a monitoring module; parse the file toidentify file language terms included in the file; match the filelanguage terms included in the file with the module-specific languageterms that are included in module-specific language information that isstored in one or more monitoring dictionary databases; determine, basedon the matching of the file programming language terms with themodule-specific programming language terms, intent for the file languageterms; and automatically classify, based on the determination of theintent for the file language terms, the file into a respective one of aplurality of monitoring model databases.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic view illustrating an embodiment of an informationhandling system.

FIG. 2 is a schematic view illustrating an embodiment of a serversystem.

FIG. 3 is a schematic view illustrating an embodiment of the serversystem of FIG. 2A.

FIG. 4 is a schematic view illustrating an embodiment of a serversystem.

FIG. 5 is a schematic view illustrating an embodiment of the serversystem of FIG. 3A.

FIG. 6 is a flow chart illustrating an embodiment of a method forintegrating monitoring and alerts using linguistic semantic analysis.

DETAILED DESCRIPTION

For purposes of this disclosure, an information handling system mayinclude any instrumentality or aggregate of instrumentalities operableto compute, calculate, determine, classify, process, transmit, receive,retrieve, originate, switch, store, display, communicate, manifest,detect, record, reproduce, handle, or utilize any form of information,intelligence, or data for business, scientific, control, or otherpurposes. For example, an information handling system may be a personalcomputer (e.g., desktop or laptop), tablet computer, mobile device(e.g., personal digital assistant (PDA) or smart phone), server (e.g.,blade server or rack server), a network storage device, or any othersuitable device and may vary in size, shape, performance, functionality,and price. The information handling system may include random accessmemory (RAM), one or more processing resources such as a centralprocessing unit (CPU) or hardware or software control logic, ROM, and/orother types of nonvolatile memory. Additional components of theinformation handling system may include one or more disk drives, one ormore network ports for communicating with external devices as well asvarious input and output (I/O) devices, such as a keyboard, a mouse,touchscreen and/or a video display. The information handling system mayalso include one or more buses operable to transmit communicationsbetween the various hardware components.

In one embodiment, IHS 100, FIG. 1, includes a processor 102, which isconnected to a bus 104. Bus 104 serves as a connection between processor102 and other components of IHS 100. An input device 106 is coupled toprocessor 102 to provide input to processor 102. Examples of inputdevices may include keyboards, touchscreens, pointing devices such asmouses, trackballs, and trackpads, and/or a variety of other inputdevices known in the art. Programs and data are stored on a mass storagedevice 108, which is coupled to processor 102. Examples of mass storagedevices may include hard discs, optical disks, magneto-optical discs,solid-state storage devices, and/or a variety other mass storage devicesknown in the art. IHS 100 further includes a display 110, which iscoupled to processor 102 by a video controller 112. A system memory 114is coupled to processor 102 to provide the processor with fast storageto facilitate execution of computer programs by processor 102. Examplesof system memory may include random access memory (RAM) devices such asdynamic RAM (DRAM), synchronous DRAM (SDRAM), solid state memorydevices, and/or a variety of other memory devices known in the art. Inan embodiment, a chassis 116 houses some or all of the components of IHS100. It should be understood that other buses and intermediate circuitscan be deployed between the components described above and processor 102to facilitate interconnection between the components and the processor102.

Referring now to FIG. 2, an embodiment of a server system 200 isillustrated. In an embodiment, the server system 200 may be provided bythe IHS 100 discussed above with reference to FIG. 1, or may includesome or all of the components of the IHS 100. In a specific embodiment,the server system 200 is provided by a single server device, althoughmultiple server devices may provide the server system while remainingwithin the scope of the present disclosure as well. In the illustratedembodiment, the server system 200 includes a chassis 202 that houses thecomponents of the server system 200, only some of which are illustratedin FIG. 2. For example, the chassis 202 may house a processing system(not illustrated, but which may include the processor discussed abovewith reference to FIG. 1) and a memory system (not illustrated, butwhich may include the memory 114 discussed above with reference toFIG. 1) that includes instructions that, when executed by the processingsystem, cause the processing system to provide a linguistic semanticmonitoring analysis engine 204 that is configured to perform thefunctions of the linguistic semantic monitoring analysis engines and/orserver systems discussed below.

The chassis 202 may also house a memory system (not illustrated, butwhich may include the memory 114 discussed above with reference toFIG. 1) that may include a development operations application 206. Aswould be understood by one of skill in the art, development operationsis a software engineering culture and practice that aims at unifyingsoftware development and software operation to shorten applicationdevelopment cycles, increase application deployment frequency, andprovide more dependable application releases. Thus, while a variety ofapplications may benefit from the teachings of the present disclosure,the systems and methods described herein have been found to provideparticular benefits for development operations applications that arereleased faster and more frequently that other types of applications. Ina specific example, development operations applications may includeNagios software, System Center Operations Manager (SCOM) software,Zabbix software, and/or a variety of other software that would beapparent to one of skill in the art in possession of the presentdisclosure.

The chassis 202 may also house a storage system (not illustrated, butwhich may include the storage device 108 discussed above with referenceto FIG. 1) that includes one or more linguistic semantic monitoringanalysis databases 208. As discussed below, the linguistic semanticmonitoring analysis database(s) 208 may include module-specificprogramming language information that identifies module-specificprogramming language terms utilized in providing the developmentoperations application 206. In an embodiment, the linguistic semanticmonitoring analysis database(s) 208 may include a monitoring classifierdictionary with module-specific language information that includesmodule-specific language terms for monitoring performed by thedevelopment operations application 206. Such module-specific languageinformation is configured for use by the linguistic semantic monitoringanalysis engine 204 in classifying file names in monitoring modules, asdiscussed in further detail below.

In some embodiments, the linguistic semantic monitoring analysisdatabase(s) 208 may identify health model variables such as “status”,“indication”, “predictive failure”, and/or other monitoring-specificlanguage terms that one of skill in the art in possession of the presentdisclosure will recognize are related to health monitoring. In someembodiments, the linguistic semantic monitoring analysis database(s) 208may identify performance/metrics/time series/value variables such as“current”, “reading”, “usage”, “statistics”, “used”, “free”,“available”, and/or other monitoring-specific language terms that one ofskill in the art in possession of the present disclosure will recognizeare related to performance/metrics/time series/value monitoring. In someembodiments, the linguistic semantic monitoring analysis database(s) 208may identify inventory property variables such as “name”, “type”,“model”, “manufacturer”, “speed”, “capacity”, “family”, “rated”, and/orother monitoring-specific language terms that one of skill in the art inpossession of the present disclosure will recognize are related toinventory property monitoring.

In some embodiments, the linguistic semantic monitoring analysisdatabase(s) 208 may identify threshold type variables such as“threshold” and/or other monitoring-specific language terms that one ofskill in the art in possession of the present disclosure will recognizeare related to threshold monitoring. In some embodiments, the linguisticsemantic monitoring analysis database(s) 208 may identify softwareversioning attributes such as “version”, “revision”, and/or othermonitoring-specific language terms that one of skill in the art inpossession of the present disclosure will recognize are related tosoftware version monitoring. In some embodiments, the linguisticsemantic monitoring analysis database(s) 208 may identify configurationstate variables such as “state”, “enabled”, and/or othermonitoring-specific language terms that one of skill in the art inpossession of the present disclosure will recognize are related toconfiguration state monitoring. In some embodiments, the linguisticsemantic monitoring analysis database(s) 208 may identify redundancyvariables such as “redundancy”, “fault tolerant”, and/or othermonitoring-specific language terms that one of skill in the art inpossession of the present disclosure will recognize are related toredundancy variable monitoring.

In some embodiments, the linguistic semantic monitoring analysisdatabase(s) 208 may also include type/model information that is relatedto how types can refer to models. For example, the type/modelinformation may identify that gauges or integers with values of 0-100generally indicate performance/metrics/time series variables.Furthermore, the type/model information may identify that integers withspecific ranges of values do not indicate performance variables. Furtherstill, the type/model information may identify that enumerations thatcontain values such as “healthy”, “error”, “warning”, and “degraded”typically indicate health model variables. While specificmonitoring-specific language information that may be included in thelinguistic semantic monitoring analysis database(s) 208 has beendescribed, one of skill in the art will recognize that a wide variety ofmonitoring-specific language information that enables the functionalitydiscussed below may be included in the linguistic semantic monitoringanalysis database(s) 208 while remaining within the scope of the presentdisclosure.

The chassis 202 may also house a plurality of monitoring modules suchas, for example, the Management Information Base (MIB) module 210 a, theMeta-Object Facility (MOF) module 210 b, and JavaScript Object Notation(JSON) module 210 c illustrated in FIG. 2. As discussed in furtherdetail below, the monitoring modules 210 a, 210 b, and 210 c mayrepresent modules that are to be utilized with the developmentoperations application 206 when it is executed on the domain/targetsystem to perform monitoring. As such the monitoring modules 210 a-c mayinclude updates, releases, and/or other modifications that are to-beintegrated into the development operations application 206. As discussedin further detail below, the linguistic sematic monitoring analysisengine 204 utilizes the linguistic semantic monitoring analysisdatabase(s) 208, and in some cases the development operationsapplication 206 itself, to integrate the monitoring modules 210 a-c foruse with the development operations application 206 by any domain/targetsystem/computing device for which module-specific language informationhas been provided in the linguistic semantic monitoring analysisdatabase(s) 208. While a specific server system has been described, oneof skill in the art in possession of the present disclosure willunderstand that server systems may include a variety of other componentsand/or component configurations for providing conventional server systemfunctionality, as well as the functionality discussed below, whileremaining within the scope of the present disclosure.

Referring now to FIG. 3, an embodiment of a server system 300 isillustrated that may be the server system 200 discussed above withreference to FIG. 1, and is provided for discussion in the examplesbelow. As can be seen, any of the monitoring modules 302 (e.g., the MIBmodule, the MOF module, and JSON module discussed above) may provideinformation to a compiler 304 and a name parser 306, each of whichprocess that information and provide it to a linguistic semanticmonitoring analysis engine 308 for use in providing the functionalitydiscussed below. The linguistic semantic monitoring analysis engine 308also receives information from a monitoring dictionary database 310, andprovides a monitoring classifier engine 312 that uses the informationfrom the monitoring dictionary database 310 to classify information fromthe monitoring modules 302 into an inventory model database 314, ahealth model database 316, and a performance model database 318. Whileonly three specific databases are illustrated, one of skill in the artin possession of the present disclosure will recognize that othermonitoring model databases may be provided for module classificationwhile remaining within the scope of the present disclosure.

Referring now to FIG. 4, an embodiment of a server system 400 isillustrated. In an embodiment, the server system 400 may be provided bythe IHS 100 discussed above with reference to FIG. 1, or may includesome or all of the components of the IHS 100. In a specific embodiment,the server system 400 is provided by a single server device, althoughmultiple server devices may provided the server system while remainingwithin the scope of the present disclosure as well. In the illustratedembodiment, the server system 400 includes a chassis 402 that houses thecomponents of the server system 400, only some of which are illustratedin FIG. 4. For example, the chassis 402 may house a processing system(not illustrated, but which may include the processor discussed abovewith reference to FIG. 1) and a memory system (not illustrated, butwhich may include the memory 114 discussed above with reference toFIG. 1) that includes instructions that, when executed by the processingsystem, cause the processing system to provide a linguistic semanticalert analysis engine 404 that is configured to perform the functions ofthe linguistic semantic alert analysis engines and/or server systemsdiscussed below. While the server system 200 and the server system 400are illustrated and described herein as separate server systems, theserver systems 200 and 400 may be provided by a common server systemwhile remaining within the scope of the present disclosure. As such, insome embodiments, the functionality of the linguistic semanticmonitoring analysis engine 204 and the linguistic semantic alertanalysis engine 404 may be combined into a single engine while remainingwithin the scope of the present disclosure.

The chassis 402 may also house a memory system (not illustrated, butwhich may include the memory 114 discussed above with reference toFIG. 1) that includes a development operations application 406. Asdiscussed above, development operations is a software engineeringculture and practice that aims at unifying software development andsoftware operation to shorten application development cycles, increaseapplication deployment frequency, and provide more dependableapplication releases. Thus, while a variety of applications may benefitfrom the teachings of the present disclosure, the systems and methodsdescribed herein have been found to provide particular benefits fordevelopment operations applications that are released faster and morefrequently that other types of applications. In a specific example,development operations applications may include Nagios software, SystemCenter Operations Manager (SCOM), Zabbix software, and/or a variety ofother software that would be apparent to one of skill in the art inpossession of the present disclosure.

The chassis 402 may also house a storage system (not illustrated, butwhich may include the storage device 108 discussed above with referenceto FIG. 1) that includes one or more linguistic semantic alert analysisdatabases 408. As discussed below, the linguistic semantic alertanalysis database(s) 408 may include an alert classifier dictionarydatabase 514 that includes module-specific programming languageinformation that identifies module-specific programming language termsfor alerts performed by the development operations application 406. Suchmodule-specific language information is configured for use by thelinguistic semantic alert analysis engine 404 in analyzing alerts toparse their meaning and identify their intent, as well as identifyalerts belonging to different categories and perform alert resolutionand consolidation, as discussed in further detail below.

In some embodiments, the linguistic semantic alert analysis database(s)408 may include an alert classification dictionary database 514 thatidentifies health state changes such as “healthy”, “failed”, “degraded”,“major”, “fatal”, “catastrophic”, and/or other alert-specific languageterms that one of skill in the art in possession of the presentdisclosure will recognize are related to health state change alerting.In some embodiments, the alert classification dictionary database 514may identify threshold crossing events such as “exceeded”, “below”,“threshold”, and/or other alert-specific language terms that one ofskill in the art in possession of the present disclosure will recognizeare related to threshold cross event alerting. In some embodiments, thealert classification dictionary database 514 may identify configurationevents such as “enabled”, “disabled”, “configured”, and/or otheralert-specific language terms that one of skill in the art in possessionof the present disclosure will recognize are related to configurationevent alerting. In some embodiments, the alert classification dictionarydatabase 514 may identify operational events such as “ready”,“building”, “starting”, “initiating”, “complete”, and/or otheralert-specific language terms that one of skill in the art in possessionof the present disclosure will recognize are related to operation eventalerting. In some embodiments, the alert classification dictionarydatabase 514 may identify login/logout and/or security alerts such as“login”, “logout”, “security”, and/or other alert-specific languageterms that one of skill in the art in possession of the presentdisclosure will recognize are related to login/logout and/or securityalerting.

In an embodiment, the linguistic semantic alert analysis database(s) 408may include a domain-specific dictionary database 510 with nouns (ornoun combinations) and verbs that are specific to a domain or othertarget system that is managed by the development operations application406. For example, such a domain or target system may include theintegrated Dell Remote Access Controller (iDRAC) available from DELL®,Inc. of Round Rock, Tex., United States. However, one of skill in theart in possession of the present disclosure will recognize that otherdomains or target systems will fall within the scope of the presentdisclosure as well. In a specific example, the domain-specific librarymay include noun or noun combinations such as “server configurationprofile”, “server profile”, “factory inventory”, “virtual disk”,“physical disk”, “light emitting device (LED)”, “share”, “credentials”,“username”, “password”, “provisioning array”, and “fast policy”. Inanother specific example, the domain-specific library may include verbssuch as “export”, “import”, “create”, “modify”, “delete”, “set”, “find”,“get”, “blink”, “unblink”, and “process”.

In an embodiment, the linguistic semantic alert analysis database(s) 408may include domain-specific component trees and/or other computingdevice information in a component tree database 508 that identifiescomponents in a domain or target system that is configured to executethe development operations application 406. For example, for a serverthat is configured to execute the development operations application406, the component tree database 508 may include“processor-memory-Redundant Array of Independent Disks(RAID)-system-iDRAC”, while for a provisioning array that is configuredto execute the development operations application 406, the componenttree database 508 may include “volume-pool”. In an embodiment, thelinguistic semantic alert analysis database(s) 408 may include adomain-specific thesaurus database 510 that may include synonyms,antonyms, and state cycles. In a specific example, synonyms in thedomain-specific thesaurus database 510 may include“set=modify=change=configure”, “get=find”, and “delete=remove”. In aspecific example, antonyms in the domain-specific thesaurus database 510may include “export-import”, “create-delete”, and “blink-unblink”. In aspecific example, state cycles in the domain-specific thesaurus database510 may include health cycle information such as“healthy-warning-critical” and lifecycle information such as“created-modified-building-deleted”. In addition, the action tags may beassociated with state cycle information. For example, “critical” may beassociated with an action tag that requires “immediate action”, while“warning” may be associated with an action tag that requires “action”.

The chassis 402 may also house a plurality of alert modules such as, forexample, the MIB module 412 and the event catalog module 414 illustratedin FIG. 4. As discussed in further detail below, the alert modules 412and 414 may represent modules that are to be utilized with thedevelopment operations application 406 when it is executed on thedomain/target system to provide alerts. As such the alert modules408-412 may include updates, releases, and/or other modifications thatare to-be integrated into the development operations application 406. Asdiscussed in further detail below, the linguistic sematic alert analysisengine 404 utilizes the linguistic semantic alert analysis database(s)408, and in some cases the development operations application 406itself, to integrate the alert modules 412 and 414 for use with thedevelopment operations application 406 by any domain/targetsystem/computing device for which module-specific information has beenprovided in the linguistic semantic alert analysis database(s) 408.While a specific server system has been described, one of skill in theart in possession of the present disclosure will understand that serversystems may include a variety of other components and/or componentconfigurations for providing conventional server system functionality,as well as the functionality discussed below, while remaining within thescope of the present disclosure.

Referring now to FIG. 5, an embodiment of a server system 500 isillustrated that may be the server system 200 discussed above withreference to FIG. 1, and is provided for discussion in the examplesbelow. As can be seen, any of an MIB database 504, an event catalogdatabase 506, a component tree database 508, and a domain-specificdictionary/thesaurus database 510 may provide information to alinguistic semantic alert analysis engine 512. The linguistic semanticmonitoring analysis engine 512 also receives information from an alertclassifier dictionary database 514, and provides an alert classifierengine 516 that uses the information from the databases 504, 506, 508,510, and 514 to classify alerts into an inventory model database 518, ahealth model database 520, and a performance model database 522. Whileonly three alert model databases are illustrated, one of skill in theart in possession of the present disclosure will recognize that otheralert module databases may be used to classify alerts while remainingwithin the scope of the present disclosure.

In a specific example utilizing an iDRAC, an event catalog database 506provided according to the teachings of the present disclosure mayinclude the following information in the table below:

Error Component # Message Causes and Resolution Severity PSU 4233 <PSUSensor Cause: Power supply is failed. Critical Name> has failed.Resolution: Check the power supply assembly and switch on the powersupply. PSU 4234 <PSU Sensor Cause: Power supply is turned off orWarning Name> is switched A/C power is turned off OFF. Resolution: Turnon the A/C power and Power Supply. PSU 4235 <PSU sensor Informationalname> is on. PDR 2299 Drive <number> is Informational operating normallyPDR 2297 Fault detected on Cause: Drive failed due to hardware CriticalDrive <number>. failure. Drive has failed Resolution: Replace the faileddisk VDR 4355 <virtual disk> has Informational returned to normal stateVDR 4356 Redundancy of Cause: One or more of physical disks WarningVirtual disk has must have failed. degraded Resolution: Replace thefailed physical disk and rebuild the virtual disk. VDR 4357 Virtual diskfailed Cause: Virtual disk has failed. Critical Resolution: Contact Dellto recover data from the virtual disk Current 2178 The system boardHealthy <name> current is within range. Current 2179 The system board .. . Warning <name> current is less than the lower warning threshold.Current 2179 The system board . . . Warning <name> current is greaterthan the upper warning threshold. Current 2180 The system board . . .Critical <name> current is less than the lower critical threshold.Current 2180 The system board . . . Critical <name> current is greaterthan the upper critical threshold.

In another specific example utilizing an iDRAC, an MIB database 504provided according to the teachings of the present disclosure mayinclude the following information below:

ObjectStatusEnum  ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION“Status of an object.” SYNTAX INTEGER { other(1),  -- the status of theobject is not one of the  following: unknown(2),  -- the status of theobject is unknown  -- (not known or monitored) ok(3),  -- the status ofthe object is ok nonCritical(4),  -- the status of the object iswarning, non-critical critical(5),  -- the status of the object iscritical (failure) nonRecoverable(6) -- the status of the object isnon-recoverable (dead) } ProcessorDeviceTableEntry ::= SEQUENCE {processorDevicechassisIndex ObjectRange, processorDeviceIndexObjectRange, processorDeviceStateCapabilities StateCapabilitiesFlags,processorDeviceStateSettings StateSettingsFlags, processorDeviceStatusObjectStatusEnum, processorDeviceType ProcessorDeviceType,processorDeviceManufacturerName String64, processorDeviceStatusStateProcessorDeviceStatusState, processorDeviceFamily ProcessorDeviceFamily,processorDeviceMaximumSpeed Unsigned32BitRange,processorDeviceCurrentSpeed Gauge, processorDeviceExternalClockSpeedUnsigned32BitRange, processorDeviceVoltage Signed32BitRange,processorDeviceVersionName String64, processorDeviceCoreCountUnsigned32BitRange, processorDeviceCoreEnabledCount Unsigned32BitRange,processorDeviceThreadCount Unsigned32BitRange,processorDeviceCharacteristics Unsigned16BitRange,processorDeviceExtendedCapabilities Unsigned16BitRange,processorDeviceExtendedSettings Unsigned16BitRange,processorDeviceBrandName String64, processorDeviceFQDD FQDDString }

One of skill in the art in possession of the present disclosure willrecognize that, in the example provided above, only processor detailsand the process health enumeration is described herein for brevity, andthe MIB database 504 may (and typically will) include a variety of otherinformation while remaining within the scope of the present disclosure.

In the example of the MIB entry provided above, all of the properties ofthe processor may be included. For example, processorDevicechassisIndex,processorDeviceIndex processorDeviceType ProcessorDeviceType,processorDeviceManufacturerName processorDeviceFamilyProcessorDeviceFamily, processorDeviceMaximumSpeedprocessorDeviceBrandName and processorDeviceFQDD in the example aboveare attributes that relate to inventory, while processorDeviceStatusprovides the health of the processor, processorDeviceVersionNameprovides the version of the processor, and processorDeviceCurrentSpeedprovides a metric attribute providing details about the current speed ofthe processor.

Referring now to FIG. 6, an embodiment of a method 600 for integratingmonitoring and alerts using linguistic semantic analysis is illustrated.As discussed below, the systems and methods of the present disclosureprovide for the integration of monitoring modules into monitoringapplications via the use of dictionaries and thesaurus that identify thesemantics utilized in the domain/target system in order to performlinguistic semantic analysis on the monitoring module and the monitoringapplication that allows for artifact name analysis to identify theintent of variables in schema files in order to classify those schemafiles into monitoring models automatically. In some embodiments, themonitoring modules may include alerts, and the systems and methods mayanalyze those alerts by identifying their intent, as well as identifyingalerts that belong to similar categories in order to enable an alertresolution/consolidation. The systems and methods of the presentdisclosure eliminate the need for “hand-coding” and the associatedmaintenance of monitoring modules that is necessary for theirintegration into applications in order to keep the monitoring providedby the applications up-to-date with regard to their operation in thedomain/target system.

In an embodiment, prior to the method 600 of the illustrated embodiment,the linguistic semantic monitoring analysis database(s) 208 may beprovided with the information discussed above with reference to FIG. 2.For example, a computing device manufacturer (i.e., of a computingdevice/domain/target system that is to execute the developmentoperations application 206) may provide the information in themonitoring dictionary database 310 and/or any of the other databasesdiscussed above. As such, the computing device manufacturer may providethe health model variables, the performance/metrics/time series/valuevariables, the inventory property variables, the threshold typevariables, the software versioning attributes, the configuration statevariables, the redundancy variables, asset information variables, and/orany other information described herein in the linguistic semanticmonitoring analysis database(s) 208. In addition, the computing devicemanufacturer may provide the type/model information in the linguisticsemantic monitoring analysis database(s) 208 as well.

In an embodiment, prior to the method 600 of the illustrated embodiment,the linguistic semantic alert analysis database(s) 408 may be providedwith the information discussed above with reference to FIG. 4. Forexample, a computing device manufacturer (i.e., of a computingdevice/domain/target system that is to execute the developmentoperations application 406) may provide the information in the alertclassification dictionary database 514 and/or any of the other databasesdiscussed above. As such, the computing device manufacturer may providethe health state changes, the threshold crossing events, theconfiguration events, the operational events, the login/logout and/orsecurity alerts, and/or any other information described herein in thealert classification dictionary database 514 and/or any of the otherdatabases discussed above. Furthermore, the computing devicemanufacturer may provide the nouns (or noun combinations) and verbs inthe domain-specific dictionary database 510, the domain-specificcomponent trees and/or other computing device information in thecomponent tree database 508, as well as the synonyms, antonyms, andstate cycles in the domain-specific thesaurus database 510.

In a specific example, state cycles in the domain-specific thesaurusdatabase 510 may include the following:

(Normal normally healthy)⇔(Warning degraded)⇔Critical (for PhysicalDisk, Virtual Disk)

On⇔Off⇔Failed (for Power Supply)

Normal⇔(less than lower warning threshold | greater than higher warningthreshold)⇔(less than lower critical threshold | greater than lowerwarning threshold) (for Current)

The method 600 begins at block 602 where a linguistic semanticmonitoring analysis engine receives a file included in a monitoringmodule. In an embodiment, at block 602, the linguistic semanticmonitoring analysis engine 204/308 may receive files from any of the MIBmodule 210 a, the MOF module 210 b, or the JSON module 210 c. In aspecific example, at block 602, a user of the server system 200 maytransfer schema files from any of the MIB module 210 a, the MOF module210 b, or the JSON module 210 c to the linguistic semantic monitoringanalysis engine 204/308. For example, in the event new domain/targetsystem/computing device monitoring support is needed for the developmentoperations application 206, or new firmware monitoring support is neededfor the development operations application 206, the method 600 may beinitiated at block 602. In a specific example including an iDRAC, theMIB database may be uploaded into the linguistic semantic monitoringanalysis engine 204/308. In a specific example including an EqualLogiciSCSI-based storage area network systems available from DELL® Inc. ofRound Rock, Tex., United States, all the 13 EqualLogic MIBs may beuploaded to the linguistic semantic monitoring analysis engine 204/308.

The method 600 then proceeds to block 604 where the linguistic semanticmonitoring analysis engine parses the file to identify file languageterms included in the file. In an embodiment, at block 602, thelinguistic semantic monitoring analysis engine 204/308 may parse thedifferent artifacts included in the schema files received from any ofthe MIB module 210 a, the MOF module 210 b, or the JSON module 210 c.For example, MIB names (e.g., scalar, tables, etc.), MOF class names,and/or JSON object class names may be parsed by the linguistic semanticmonitoring analysis engine 204/308 at block 604. In an embodiment, atblock 604, the linguistic semantic alert analysis engine 204/308 mayutilize the name parser 306 to parse the schema files received from anyof the MIB module 210 a, the MOF module 210 b, or the JSON module 210 cat block 602 in order to identify file language terms included in thosefiles. For example, the linguistic semantic analysis engine 204/308 mayoperate at block 604 to parse the files received at block 602 todetermine the names utilized for those files by splitting the file namesinto file language terms. In a specific example, such file languageterms included in the file names may be identified by reversing theHungarian notations utilized in the file names, splitting the filelanguage terms included in the file names when a underscore (“_”) isidentified, and/or using other techniques that would be apparent to oneof skill in the art in possession of the present disclosure.

In one example of parsing operations that may be performed at block 604,the artifact in the file may include “processorDeviceType”. As would beappreciated by one of skill in the art in possession of the presentdisclosure, Hungarian notation requires that all English wordsrepresenting a function be combined into a single function name, withfirst character of every English word capitalized. As such, a functionto create a “processor device type” would be named as“processorDeviceType”. The linguistic semantic monitoring analysisengine 204/308 may include logic to identify the original English wordsby splitting the function name “processorDeviceType” at each capitalcharacter boundary to identify the words processor, device and type.

In another example of parsing operations that may be performed at block604, the artifact in the file may include “processor_device_type”. Aswould be appreciated by one of skill in the art in possession of thepresent disclosure, function names may be built by combining the Englishwords using an underscore “_”, with each of the terms in lower case. Assuch, the processor device type may be defined by the function name“processor_device_type”. The linguistic semantic monitoring analysisengine 204/308 may include logic to identify the original English wordsby splitting the function name using the underscore to identify thewords processor, device and type. One of skill in the art in possessionof the present disclosure will recognize that the above function namingconventions are almost universally used in the industry. However, othernaming conventions followed in a MIB and/or JSON schema may be utilizedto perform similar functionality at block 604 while remaining within thescope of the present disclosure as well.

The method 600 then proceeds to block 606 where the linguistic semanticmonitoring analysis engine matches the file language terms withmodule-specific language terms. In an embodiment, at block 606, thelinguistic semantic monitoring analysis engine 204 may match the fileterms identified in the schema files received for any of the MIB module210 a, the MOF module 210 b, or the JSON module 210 c withmodule-specific language terms stored in the linguistic semanticmonitoring analysis database(s) 208. For example, the linguisticsemantic monitoring analysis engine 204/308 may operate at block 606 tomatch the file language terms identified in the file(s) received for theMIB module 210 a with any of the information included in the linguisticsemantic monitoring analysis database(s) 208. In a specific example, thelinguistic semantic analysis engine 204 may operate to match filelanguage terms in schema files to module specific language termsincluded in the monitoring dictionary database 310.

In a specific example, nouns in the monitoring dictionary database 510may include the terms such as processor, current, physical disk, virtualdisk, and/or a variety of other nouns that would be apparent to one ofskill in the art in possession of the present disclosure.

In a specific example, the monitoring dictionary database 310 may alsoinclude the information in the following table:

Enumeration Type Type Monitoring Model English Terms IndicatorsIndicators Health Model “Status”, “Indication”, “healthy”, “failed”,“Predictive Failure” “degraded”, “major”, “fatal”, “catastrophic”, “on”,“off”, “normally”, “normal” Performance Model “Current”, “Reading”,Gauge “Usage”, “Statistics”, “Used”, “Free”, “Available” Inventory Model“Name”, “Type”, “Model”, FQDDString “Manufacturer”, “Speed”, “Capacity”,“Family”, “Rated” Threshold Model Threshold Versioning Model Revision,Version Configuration State “State” “Enabled” Variable

In a specific example, the alert classifier dictionary database 514 mayalso include the information in the following table:

Alert Classifier Adverbs/Terms Health State Change “healthy”, “failed”,“degraded”, “major”, “fatal”, “catastrophic”, “on”, “off”, “normally”,“normal” Threshold Crossing “exceeded”, “below”, “threshold”, “within”,“above”, “less than”, “greater than” Operational Events “ready”,“building”, “starting” “initializing” Configuration State “Disabled”“Enabled” Variable

At block 504 and using the MIB database 504, the linguistic semanticmonitoring analysis engine 204/308 may select the name of the attributes(e.g., in column 1 of the table below), parse the name into individualwords as discussed above (e.g., and illustrated in column 2 of the tablebelow), map the words with the Monitoring classifier dictionary 310(e.g., as illustrated in column 3 of the table below), and identify thetype of the monitoring model that attribute represents (e.g., asillustrated in column 4 of the table below):

Name in the MIB Schema Names parsed Looking up into the Conclusion intoindividual Monitoring Classifier components DictionaryprocessorDevicechassisIndex Processor, Index is Inventory InventoryDevicechassis, Model Index processorDeviceIndex Processor, Index isInventory Inventory Device, Index Model processorDeviceStatus Processor,Status is Health Model Health Device, Status processorDeviceTypeProcessor, Type is Inventory Inventory Device, Type ModelprocessorDeviceManufacturer Processor, Manufacturer is Inventory Device,Inventory Model Manufacturer processorDeviceStatusState Processor, Stateis Configuration Configuration Device, Status, Model (when word StateState comes at the end, it is always Configuration ModelprocessorDeviceFamily Processor, Family is Inventory Inventory Device,Family Model processorDeviceMaximumSpeed Processor, Speed is InventoryInventory Device, Model Maximum, Speed processorDeviceCurrentSpeedProcessor, Current is Performance Device, Current, Performance Model.Speed (Current always follows with the inventory attribute which itrepresents) processorDeviceVersionName Processor, Version is VerisoningVersioning Device, Version Model processorDeviceBrandName Processor,Name is Inventory Inventory Device, Brand, Model NameprocessorDeviceFQDD Processor, FQDD is Inventory Inventory Device, FQDDModel

Similarly, at block 504 and using the event catalog database 506, thelinguistic semantic monitoring analysis engine 204 may select themessage column of the catalog (e.g., as in column 3 of the table below),map words in the message catalog using the Monitoring classifierdictionary 310 (e.g., as illustrated in column 4 of the table below),and identify the type of the monitoring model that attribute represents(e.g., as illustrated in column 4 of the table below):

Com- Error Mapping to Alert Alert ponent # Message Classifier dictionaryModel PSU 4233 <PSU Sensor Name> “failed” maps to Health has failed.Health State Change PSU 4234 <PSU Sensor Name> “off” maps to HealthHealth is switched OFF. State Change PSU 4235 <PSU sensor name> “on”maps to Health Health is on. State Change PDR 2299 Physical disk“normally” maps to Health <number> is Health State operating normallyChange PDR 2297 Fault detected on “failed” maps to Health physical diskHealth State <number>. Change Physical disk has failed VDR 4355 <virtualdisk> has “normal” maps to Health returned to normal Health State stateChange VDR 4356 Redundancy of “degraded” maps to Health Virtual disk hasRedundancy Health degraded State Change VDR 4357 Virtual disk failed“failed” maps to Health Health State Change Current 2178 The systemboard “within” refers to Threshold <name> current is Threshold crossingwithin range. events Current 2179 The system board “less than”, “lower”Threshold <name> current is refers to Threshold less than the lowercrossing events warning threshold. Current 2179 The system board“greater than”, Threshold <name> current is “upper” refers to greaterthan the Threshold crossing upper warning events threshold. Current 2180The system board “less than”, “lower” Threshold <name> current is refersto Threshold less than the lower crossing events critical threshold.Current 2180 The system board “greater than”, Threshold <name> currentis “upper” refers to greater than the Threshold crossing upper criticalevents threshold.

The method 600 then proceeds to block 608 where the linguistic semanticmonitoring analysis engine determines intent for the file languageterms. In an embodiment, at block 608, the linguistic semanticmonitoring analysis engine 204 may utilize the processing of the schemafiles for any of the MIB module 210 a, the MOF module 210 b, or the JSONmodule 210 c that was performed at blocks 402, 404, and/or 406 todetermine intent for their file language terms. For example, thelinguistic semantic analysis engine 204/302 may operate at block 608 toutilize schema file names determined for the schema files in the MIBmodule 210 a/302, along with information in the linguistic semanticmonitoring analysis database(s) 208, to determine the intent of the filelanguage terms included in the MIB module 210 a/308. In an embodiment,the intent determined for the file language terms provides for theinformation in column 5 in the table above, which represents themonitoring module or alert module to which the object belongs. As such,one of skill in the art in possession of the present disclosure willrecognize how, following block 608, the schema files in the MIB module210 a/412 that provide for the monitoring of particular aspects ofobjects and/or properties utilized by the domain/target system/computingdevice may be determined.

The method 600 then proceeds to block 610 where the linguistic semanticmonitoring analysis engine automatically classifies the files intomonitoring model databases. In an embodiment, at block 610, thelinguistic semantic monitoring analysis engine 204 may utilize theintent determined for the file language terms for any of the schemafiles in the MIB module 210 a, the MOF module 210 b, or the JSON module210 c to automatically classify those files into a monitoring modeldatabase. For example, at block 610, the linguistic semantic monitoringanalysis engine 204 may utilize the intent determined for the filelanguage terms in the files of the MIB module 210 a/308 in order toclassify that schema file for the MIB module 210 a/302 in any one of theinventory model database 314, the health model database 316, or theperformance model database 318, as illustrated in the table(s) above.

In a specific example, at blocks 406, 408, and 410, file language termsfrom schema files may be matched to module-specific language terms inthe monitoring dictionary database 310, and the monitoring classifierengine 312 in the linguistic semantic monitoring analysis engine 312 mayoperate to use that matching to determine intent for the schema files,and then use that intent to classify those schema files into theinventory model database 314, the health model database 316, theperformance model database 318, and/or any other monitoring modeldatabases that are available to the linguistic semantic monitoringanalysis engine 312. In the event there are multiple monitoring modeldatabases that may be appropriate for a schema file, the type andenumeration values included in properties in the schema file may be usedto classify that schema file. One of skill in the art in possession ofthe present disclosure will recognize that such use of type andenumeration values will typically allow the schema file to be classifiedinto a particular monitoring model. In the event such classification isnot possible, manual classification by the user of the server system 200may be performed.

In the example, utilizing the MIB discussed above, an MIB object“processDeviceStatus” may refer to “ObjectStatusEnum”, which is definedas an Enumeration (TEXTUAL-CONVENTION) below:

ObjectStatusEnum  ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION“Status of an object.” SYNTAX INTEGER { other(1), -- the status of theobject is not one of the -- following: unknown(2), -- the status of theobject is unknown -- (not known or monitored) ok(3), -- the status ofthe object is ok nonCritical(4), -- the status of the object is warning,non-critical critical(5), -- the status of the object is critical(failure) nonRecoverable(6) -- the status of the object isnon-recoverable (dead) }

This enumeration in the above example contains key words such as“other”, “unknown”, “ok”, “noncritical”, “fatal”, and “catastrophic”,and the linguistic semantic monitoring analysis engine 204 may determinethat these keywords are associated with a Health Model in the MonitoringClassifier Dictionary. Furthermore, the linguistic semantic monitoringanalysis engine 204 may determine that the attribute“processorDeviceCurrentSpeed” is indicated as Gauge and, in response,associate it with a Performance Model in the Monitoring ClassifierDictionary. As would be appreciated by one of skill in the art inpossession of the present disclosure, such determination may beunnecessary if the parsing discussed above with reference to block 604is successful.

In an embodiment, component relationships associated with the monitoringof components may be are tracked through associations (e.g., WSMANassociations), index relationships (e.g., SNMP relationships), and/orJSON references. For example, a virtual disk will always have an indexthat represents its associated contained controller, while sensors maybe associated with their relevant subsystem or component indexes thatmay be used to create a component tree structures.

In the specific example, using the EqualLogic systems discussed above,the following relationship may exist: diskMIB=>EQLDISK-MIB=>eqIDiskTable, and may provide for the following:

eqlDiskEntry OBJECT-TYPE -- 1.3.6.1.4.1.12740.3.1.1.1SYNTAX EqlDiskEntry MAX-ACCESS not-accessible INDEX { eqlGroupId,eqlMemberIndex, eqlDiskIndex } DESCRIPTION “An entry (row) containing alist of disk status parameters.” ::= { eqlDiskTable 1 }

Furthermore, the Index for eqIDiskTable (eql, Disk, Table=>Diskcomponent) may include the following 3 parts:

eqlGroupId->represents the EqualLogic Group

eqlMemberIndex->represents the EqualLogic Member within the EqualLogicGroup

eqlDiskIndex->represents the EqualLogic Disk within the EqualLogicMember.

As such, a Disk is contained inside a Member which in turn is containedinside the EqualLogic Group, which would provide the topmost object inthe hierarchy.

In some embodiments, there may be aspects associated with monitoringdomains. For example, thresholds are typically associated with metrics,while status attributes are typically associated with health, and eachmay be identified by the name analysis discussed above. In a specificexample, thresholds may include names such as “warning threshold”,“critical threshold”, “upper warning threshold”, etc., and theattributes/properties associated with those names may be linked to thosethresholds. In the table for the alert classification database discussedabove, the threshold events include a “critical threshold”, “upperwarning threshold” etc., each of which may be considered as part of thethreshold events.

In some embodiments, the schema files from the MIB module 210 a, the MOFmodule 210 b, or the JSON module 210 c may include alert files that areprovided to the linguistic semantic alert analysis engine 404/512 atblock 602. Following the receiving of the alert file at block 602, themethod 600 may proceed to block 604 where the linguistic semantic alertanalysis engine 404/512 parses the alert file to identify file languageterms included in the alert file, and block 606 where the linguisticsemantic alert analysis engine 404/512 matches the file language termsincluded in the alert file with alert-specific language information inthe linguistic semantic alert analysis database(s) 408.

For example, the linguistic semantic alert analysis engine 404/512 mayperform the method 600 by splitting the alert file into alert languageterms, and matching those alert language terms to module-specificlanguage terms in the alert classification dictionary database 514. In aspecific example, this allows the alert files to be classified as“health”, “operation”, “audit”, and/or other alert classifications thatwould be apparent to one of skill in the art in possession of thepresent disclosure. In addition, the linguistic semantic alert analysisengine 404/512 may perform the method 600 by looking up nouns in thealert file and matching them to nouns in the domain-specific dictionarydatabase 510, and then using those matching nouns to associate the alertfile with a component identified in the component tree database 508. Inthe event more than one noun is found in the alert file, the longestmatch may be used. In some examples, multiple components may be referredto in an alert file (e.g., a controller and a virtual disk may bereferred to in the alert file), in which case each component referred toin the alert file may be associated with that alert file. One of skillit the art in possession of the present disclosure will recognize thatalert files may typically be associated with components that arerelatively low in the component tree hierarchy. In the table for thealert classification database discussed above, if a lookup for thecomponents inside the Message column is attempted, “physical disk” willbe found in all Physical disk alerts, “current” will be found in allCurrent related alerts, and “virtual disk” will be found in all VirtualDisk alerts. In situations where a message such as “Virtual disk faileddue to physical disk failure” is provided, both “virtual disk” and“physical disk” will be found in the event, and the system may associatethe corresponding event to physical disk component.

In addition, the linguistic semantic alert analysis engine 404/512 mayperform the method 600 by looking up verbs in the alert file andmatching them to verbs in the domain-specific dictionary database 510,and using those verbs to associate the alert file with a specificoperation. For example, verbs from the message may be found via theadverbs in the table for the alert classification database discussedabove. Following the processing discussed above, the alert file may bemapped to state machines in the domain/target system/computing device.In the event different alert files are mapped to the same component,operation, and classification model, those alert files may be consideredpart of a candidate set. In some examples, alert files that are part ofa candidate set (e.g., belonging to the same category) may operate tocancel each other for certain alert categories (e.g., threshold alertsand health alerts) in order to consolidate those alert files, while inother examples alert files that are part of the same candidate set willnot cancel each other.

In a specific example involving an iDRAC with two physical disks (“PD.1”and “PD.2”), the following two events may be generated:

Alert 1 @ Apr. 25, 2018 10:30 AM: Physical disk PD.1 is operatingnormallyAlert 2 @ Apr. 25, 2018 3:30 PM: Fault detected on physical disk PD.1.Physical disk has failed

The linguistic semantic alert analysis engine 404/512 may apply theclassification logic discussed above to determine:

Alert 1=>physical disk alert=>“normally” refers to a first state in thestate cycle, and the event is associated with PD.1.Alert 2=>physical disk alert=>“failed” refers to a second state in thestate cycle that is different than the first state, and the event isassociated with PD.1

The matching of the component and the instance allows the linguisticsemantic alert analysis engine 404/512 to conclude that these two alertsare related to the same instance but are coming at different points intime. The linguistic semantic alert analysis engine 404/512 may thenassume that Alert 2 is the current situation, whereas Alert 1 was anolder situation, and may operate to remove Alert 1 or treat Alert 2 assuperseding Alert 1.

Following the classification of alert files, when a new alert file isprovided, it may be forwarded to the linguistic semantic alert analysisengine 404/512, which may operate to identify whether the new alert filebelongs to a particular monitoring model. If so, the linguistic semanticalert analysis engine 404/512 may access the component tree associatedwith the new alert file and extract the component instanceidentification in the new alert file (e.g., via the word parsingdescribed above). If existing alert files exist that may be cancelled,the alerts associated with those existing alert files may be cancelled.Otherwise, the new alert file may be appended to the monitoring model asdetailed above.

Thus, systems and methods have been described that provide for theintegration of monitoring modules into monitoring applications via theuse of dictionaries and thesaurus that identify the semantics utilizedin the domain/target system in order to perform linguistic semanticanalysis on the monitoring module and the application that allows forthe name analysis of artifacts to identify the intent of variables inthe monitoring module to allow their classification into monitoringmodels automatically. In some embodiments, the monitoring modules mayinclude alerts, and the systems and methods may analyze those alerts byidentifying their intent, as well as identify alerts that belong tosimilar categories in order to enable an alert resolution/consolidation.The systems and methods of the present disclosure eliminate the need for“hand-coding” and the associated maintenance of monitoring modules thatis necessary for their integration into applications in order to keepthe monitoring provided by the applications up-to-date with regard totheir operation in the domain/target system

Although illustrative embodiments have been shown and described, a widerange of modification, change and substitution is contemplated in theforegoing disclosure and in some instances, some features of theembodiments may be employed without a corresponding use of otherfeatures. Accordingly, it is appropriate that the appended claims beconstrued broadly and in a manner consistent with the scope of theembodiments disclosed herein.

What is claimed is:
 1. A linguistic semantic analysis monitoring/alertintegration system, comprising: at least one storage device storing oneor more monitoring dictionary databases that include module-specificlanguage information that identifies module-specific language termsutilized in providing a monitoring module; and a linguistic semanticmonitoring analysis engine that is coupled to the at least one storagedevice, wherein the linguistic semantic monitoring analysis engine isconfigured to: receive a file included in a monitoring module; parse thefile to identify file language terms included in the file; match thefile language terms included in the file with the module-specificlanguage terms included in the module-specific language information;determine, based on the matching of the file programming language termswith the module-specific programming language terms, intent for the filelanguage terms; and automatically classify, based on the determinationof the intent for the file language terms, the file into a respectiveone of a plurality of monitoring model databases.
 2. The system of claim1, wherein the one or more monitoring model databases include a healthmodel database, a performance model database, and an inventory modeldatabase.
 3. The system of claim 1, wherein the module-specific languageinformation includes health model variables, performance modelvariables, and inventory model variables.
 4. The system of claim 1,wherein the file includes one of a Management Information Base (MIB)file, a Meta-Object Facility (MOF) file, and a JavaScript ObjectNotation (JSON) file.
 5. The system of claim 1, wherein the file is afirst alert file.
 6. The system of claim 5, wherein the linguisticsemantic analysis engine is configured to: associate a noun filelanguage term in the first alert file with a component in a computingdevice; associate a verb file language term in the first alert file withan operation; and map the first alert file to a state machine in thecomputing device based on the classification, component, and operationof the first alert file.
 7. The system of claim 6, wherein thelinguistic semantic analysis engine is configured to: cancel at leastone second alert file that is mapped to the state machine in thecomputing device based on the second alert file being mapped to the sameclassification, component, and operation as the first alert file.
 8. AnInformation Handling System (IHS), comprising: a processing system; anda memory system that is coupled to the processing system and thatincludes instructions that, when executed by the processing system,cause the processing system to provide a linguistic semantic monitoringanalysis engine that is configured to: receive a file included in amonitoring module; parse the file to identify file language termsincluded in the file; match the file language terms included in the filewith the module-specific language terms that are included inmodule-specific language information that is stored in one or moremonitoring dictionary databases; determine, based on the matching of thefile programming language terms with the module-specific programminglanguage terms, intent for the file language terms; and automaticallyclassify, based on the determination of the intent for the file languageterms, the file into a respective one of a plurality of monitoring modeldatabases.
 9. The IHS of claim 8, wherein the one or more monitoringmodel databases include a health model database, a performance modeldatabase, and an inventory model database.
 10. The IHS of claim 8,wherein the module-specific language information includes health modelvariables, performance model variables, and inventory model variables.11. The IHS of claim 8, wherein the file includes one of a ManagementInformation Base (MIB) file, a Meta-Object Facility (MOF) file, and aJavaScript Object Notation (JSON) file.
 12. The IHS of claim 8, whereinthe file is a first alert file.
 13. The IHS of claim 12, wherein thelinguistic semantic analysis engine is configured to: associate a nounfile language term in the first alert file with a component in acomputing device; associate a verb file language term in the first alertfile with an operation; map the first alert file to a state machine inthe computing device based on the classification, component, andoperation of the first alert file; and cancel at least one second alertfile that is mapped to the state machine in the computing device basedon the second alert file being mapped to the same classification,component, and operation as the first alert file.
 14. A method forintegrating monitoring and alerts using linguistic semantic analysis,comprising: receiving, by a linguistic semantic monitoring analysissystem, a file included in a monitoring module; parsing, by thelinguistic semantic monitoring analysis system, the file to identifyfile language terms included in the file; matching, by the linguisticsemantic monitoring analysis system, the file language terms included inthe file with the module-specific language terms that are included inmodule-specific language information that is stored in one or moremonitoring dictionary databases; determining, by the linguistic semanticmonitoring analysis system based on the matching of the file programminglanguage terms with the module-specific programming language terms,intent for the file language terms; and automatically classifying, bythe linguistic semantic monitoring analysis system based on thedetermination of the intent for the file language terms, the file into arespective one of a plurality of monitoring model databases.
 15. Themethod of claim 14, wherein the one or more monitoring model databasesinclude a health model database, a performance model database, and aninventory model database.
 16. The method of claim 14, wherein themodule-specific language information includes health model variables,performance model variables, and inventory model variables.
 17. Themethod of claim 14, wherein the file includes one of a ManagementInformation Base (MIB) file, a Meta-Object Facility (MOF) file, and aJavaScript Object Notation (JSON) file.
 18. The method of claim 14,wherein the file is a first alert file.
 19. The method of claim 18,further comprising: associating, by the linguistic semantic monitoringanalysis system, a noun file language term in the first alert file witha component in a computing device; associating, by the linguisticsemantic monitoring analysis system, a verb file language term in thefirst alert file with an operation; and mapping, by the linguisticsemantic monitoring analysis system, the first alert file to a statemachine in the computing device based on the classification, component,and operation of the first alert file.
 20. The method of claim 19,further comprising: cancelling, by the linguistic semantic monitoringanalysis system, at least one second alert file that is mapped to thestate machine in the computing device based on the second alert filebeing mapped to the same classification, component, and operation as thefirst alert file.